diff --git a/vars/per-machine/ns1/dns-acme-gw-cnx-1-knot/acme.conf/groups/admins b/vars/per-machine/ns1/dns-acme-gw-cnx-1-knot/acme.conf/groups/admins
new file mode 120000
index 0000000..6765aa1
--- /dev/null
+++ b/vars/per-machine/ns1/dns-acme-gw-cnx-1-knot/acme.conf/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
\ No newline at end of file
diff --git a/vars/per-machine/ns1/dns-acme-gw-cnx-1-knot/acme.conf/machines/ns1 b/vars/per-machine/ns1/dns-acme-gw-cnx-1-knot/acme.conf/machines/ns1
new file mode 120000
index 0000000..ef04008
--- /dev/null
+++ b/vars/per-machine/ns1/dns-acme-gw-cnx-1-knot/acme.conf/machines/ns1
@@ -0,0 +1 @@
+../../../../../../sops/machines/ns1
\ No newline at end of file
diff --git a/vars/per-machine/ns1/dns-acme-gw-cnx-1-knot/acme.conf/secret b/vars/per-machine/ns1/dns-acme-gw-cnx-1-knot/acme.conf/secret
new file mode 100644
index 0000000..c5dad05
--- /dev/null
+++ b/vars/per-machine/ns1/dns-acme-gw-cnx-1-knot/acme.conf/secret
@@ -0,0 +1,22 @@
+{
+	"data": "ENC[AES256_GCM,data:Y0fYYbD4wqi/WNt+dzVFkJ6ZH4PLC34T3dbmPw0bVFCNCbNF/twHwALVihVc18Oc2PbLpudY5DKr3s0zwfoG7YzPn0Hlc6+KsotoG+8R71WRo3D9yZbGz2ajdDCuglfLbhFmuDAlQjAHFWVUV5HH,iv:CbNFBo0As6cu/1n/BuwqqMn8wbx76i1HZ1Y3g6DiBcA=,tag:0VlCjAK6ZwP0eDxRcqowvg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5NndmSXF2MWc2MEtZZ09u\nR0xQWUlGWWo5VFRMTFgwOCtFMVdJbXB0MlcwCktRNG9tQVJJOUlPbXlBbTFyb1NE\nSmZ2OVpXNUxUdjZhYTl1aG1DV3ZkNzAKLS0tIEtiOGVaMTZrbHBRZGVBRlQ2VE1G\ncWhkVzZ4Yk1GY3ZXNnJzcFk3NUs0N2sK44Dw4YMuUSiu+XVR/By1Tdm+ikGZr8sW\nsOr8BVOUH14yF3L5pGd3DoJIYPKqcaUiDpg6qSsqYXD8UYaB8c6d4Q==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fanu282vm7njjweqhrpcfcwpttuhce8js4tsyfry98l0neaqpewqs5s7nt"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrSkppQU1sbm9WaDIrUGEx\nRjJWakpReXFCVTBaR2RqN3pNVDV6c1hySVVrCjdtRlFTMHNEc3J1NjMwczlvVWdx\nSVBjVXhGQVFFbXdEbVVFWHFHbEppQ3MKLS0tIG1DdzFqYURxNFBWQjF6NXl6YVU3\nZ2tYWjN4MVNMVGNjSmVJYWs2SnVjQVkK5kS5kpZO22EAAdokjM44g7hZy+bdOKrc\nrC6DjBwpI+BtJjXdO8nltBIXKhOBz+8sHI0XPuQP58UjKRD3YtaaJA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBMnFiMFhr\nci9GdmZvRnhaVXNtR1NDcDZrcXhKd0V1Nm4wQnpUeWNiY253WApnUlJVNG4wZStX\nRkZIOEVBVTlNcS8zUWVqM0xldGRXVjNTWlZqWE5lTXpNCi0tLSBxSkVLY0k4dkpH\nbjRJOWhWekhhbXV4bldUWVE2UXRRbXlpeUJtUWVJcU1nCmxN/fEWLPJuzt6bYdNA\n+FUSn7Q3WLLgIGmCMxy+xxNBh3Sbu9ZRd9and2tNwcwBcCiywsrESQc5SD0RFqNU\ncqQ=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
+			}
+		],
+		"lastmodified": "2026-07-31T03:07:42Z",
+		"mac": "ENC[AES256_GCM,data:0Ugi6vc7hWdXxCbVuRoq0yuAl15N0Udndf3QISlteWdiV9F3Cg99S/NpCa9PPk7EKOGJ9+Ow0mJAZVJqz9l5Zuvq4wpClU9hSe7VMuUO2sF8EambdEQtrHccV560DecFZn/lgYhnJIhJOUAKuqR7PoyGN5A+64vSc18KgNU8Euc=,iv:cnhktstJBZIAt1RU84fX8YV4IPrYPUQAjNGlXweNJFo=,tag:D2Qqyu+utno09ADAPXUkVA==,type:str]",
+		"version": "3.13.1"
+	}
+}
diff --git a/vars/per-machine/ns1/dns-acme-gw-cnx-1-knot/acme.conf/users/berwn b/vars/per-machine/ns1/dns-acme-gw-cnx-1-knot/acme.conf/users/berwn
new file mode 120000
index 0000000..57d4221
--- /dev/null
+++ b/vars/per-machine/ns1/dns-acme-gw-cnx-1-knot/acme.conf/users/berwn
@@ -0,0 +1 @@
+../../../../../../sops/users/berwn
\ No newline at end of file